1. Technical Field of the Invention
The present invention is directed, in general, to computer security systems. More particularly, and not by way of limitation, the present invention is directed to a system and method for generating and authenticating a two-factor password to protect a computer system from unauthorized access.
2. Description of Related Art
Computers and networks are often protected by passwords. In order to gain access to the computer or network, a user must enter a password. The computer or network controller (server) authenticates the password by comparing the password entered by the user with a stored password. If the entered password matches the stored password, the user is given access. If not, the user is denied access.
A major problem with password-protected computer systems is the already large and growing threat from “hackers.” The popular definition of a hacker refers to individuals who gain unauthorized access to computer systems for the purpose of stealing and/or corrupting data. Hackers are known for breaking into supposedly secure computer systems and damaging web sites, credit card accounts, internal databases, and the like.
Hacker software tools include programs that try many combinations of numbers and letters over a set period of time in an attempt to compromise a password-protected system. On some computer operating systems, as each letter or number is presented by the hacker, the letter or number is confirmed by the system as being correct or incorrect. This serial confirmation sequence actually makes it easier for a hacker to gain entry because fewer combinations of letters and numbers have to be tried. On other operating systems, the password must be completely entered correctly before confirmation is supplied by the system. This may slow down the password discovery process, but with time, the hacker can eventually present a correct password to the target computer system.
In one existing solution, the user creates a two-factor password whenever the user logs on. The first factor is the user's personal identification number (PIN), which the user enters as the first part of the password. The user obtains the second factor from an electronic token, which displays a 6-digit number. The token is time-synchronized with the authentication server, and the number displayed on the token changes every minute. The user enters the 6-digit number displayed on the token as the second part of the password. Any hacker who has learned the user's PIN cannot gain access because the hacker does not know the second factor, i.e., the 6-digit number from the token.
This two-factor password works well, but has several disadvantages. First, if a user does not have his token with him, he cannot log in. Second, if the token breaks or the battery fails, the user cannot log in. Third, even if everything works as advertised, the user has the burden of having to look at the token and enter a different 6-digit number, in addition to the user's PIN, every time he logs on. If a company has a network that kicks the user off every 5-10 minutes if he doesn't continually use the computer, entering the extra token number every time he logs back on becomes a serious burden.
Therefore, a need exists in the art for an improved system and method for generating and authenticating a password to protect a computer system from unauthorized access. In particular, there is a need for a client device, system, and method that is simple to implement and capable of providing virtually hacker-proof protection for an online computer system. The present invention provides such a client device, system, and method.